@@ -, +, @@ sco-patron-image CGI::param called in list context from package C4::Service line 212, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436. members/default_messageprefs.pl:my ($categorycode) = C4::Service->require_params('categorycode'); opac/sco/sco-patron-image.pl:my ($borrowernumber) = C4::Service->require_params('borrowernumber'); opac/sco/sco-patron-image.pl:my ($csrf_token) = C4::Service->require_params('csrf_token'); svc/cataloguing/metasearch:my ( $query_string, $servers ) = C4::Service->require_params( 'q', 'servers' ); --- C4/Service.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/C4/Service.pm +++ a/C4/Service.pm @@ -209,7 +209,7 @@ sub require_params { for my $param ( @params ) { $class->return_error( 'params', "Missing '$param'" ) if ( !defined( $query->param( $param ) ) ); - push @values, $query->param( $param ); + push @values, scalar $query->param( $param ); # will we ever need multi_param here? } return @values; --